Security Disclosures

The canonical security policy, including how to report a vulnerability, is in the repository's SECURITY.md.